PhonePe

Is PhonePe safe?

For everyday UPI payments in India, yes, with the same caveats as any UPI app. The money never sits with PhonePe. It moves straight from your bank account to the other person's, and each payment needs your UPI PIN. What PhonePe does hold is a large amount of data about you, and the scams on UPI are real and fast. We score it 59/100, a little above PayPal (55), which has a breach on its record, and below Gmail and Google Maps.

PhonePe is India's most used payment app. Reuters reported in March 2026 that it has more than 650 million registered users and handled nearly 10 billion of the 21.7 billion UPI payments made in January 2026. That reach is why scammers target it.

Who holds your money?

This is the most important thing to understand. PhonePe Limited is not a bank. For UPI, its terms describe it as a third-party app provider authorised by the National Payments Corporation of India (NPCI) to work through three sponsor banks: Yes Bank, Axis Bank and ICICI Bank. Your money stays in your own bank account until you pay, and that account keeps its normal deposit insuranceDeposit insuranceA government-backed scheme that repays bank customers up to a set limit if their bank fails, such as the FDIC in the US or the FSCS in the UK.More in the glossary with your bank. PhonePe says it does not store your linked bank account number.

The PhonePe Wallet is different. It is a prepaid payment instrument that PhonePe itself issues under an RBI authorisation, with a balance cap of ₹10,000 for the basic version. Wallet money sits in an escrow account that should always cover what PhonePe owes users and merchants. In September 2025 the RBI found that on certain days between October 2023 and December 2024 it did not, and that PhonePe failed to report the shortfall at once. It fined the company ₹21 lakh. The RBI had already fined PhonePe ₹1 crore in 2019 over prepaid instrument rules. Neither case involved lost customer money, but keep wallet balances small.

What does PhonePe collect?

A lot. Its privacy policy lists your contacts, location, device identifiers, transaction history, bank details, and the SMS messages stored on your phone. It reads SMS to register your device and handle OTPs, and also for bill reminders and "any other legitimate uses with your explicit consent". It shares data with merchants, lenders, credit bureaus, insurers and its own marketing teams, and uses it for tailored offers. Data is stored in India.

Apple's privacy label shows advertising data used to track you across other companies' apps, and precise location used for PhonePe's own marketing. Oddly, it marks name, phone number and payment details as not linked to you, which is hard to square with a payment account. Google Play's data safety section says the app shares no data with third parties but collects location and device IDs for advertising.

What are the common PhonePe scams?

India's Finance Ministry told Parliament in December 2025 that UPI fraud across all apps reached 12.64 lakh incidents worth ₹981 crore in 2024-25, after ₹1,087 crore in 2023-24. That is small next to the billions of payments made each month, but each case is a real loss, and UPI transfers are instant and final.

The patterns repeat:

• Collect requests. A "buyer" on a classifieds site sends a payment request and tells you to enter your PIN to receive money. Entering the PIN always sends money.
• QR codes. Scanning a QR code is for paying, never for receiving.
• Fake customer care. Numbers found by web search or social media lead to people who ask you to install screen-sharing apps.
• Fake payment screenshots. Shopkeepers are shown an edited "success" screen. Check your own bank or app history.

There is no purchase protection for payments to people, unlike PayPal's goods and services payments. Refunds depend on the recipient's bank freezing the money before it is withdrawn.

How to use PhonePe safely

1. Never enter your UPI PIN to receive money, and never share it or an OTP with anyone.
2. Turn on the app lock and keep your phone's screen lock strong. Anyone who can unlock your phone and knows your PIN can pay.
3. Decline collect requests from strangers. If someone insists, ask them to send money to your UPI ID instead.
4. Get help only from inside the app. PhonePe staff will not ask you to install screen-sharing apps.
5. If you are scammed, report it in the app, to your bank and on 1930 straight away.
6. Keep the wallet balance low, since it is not a bank deposit.

How we scored it

Regulatory record (75) is PhonePe's strongest factor: two RBI penalties, both small and about wallet compliance, and no privacy fine. Scams and harmful content (50) is the weakest, because UPI fraud is widespread and payments cannot be reversed. Privacy (52) reflects broad collection, SMS access and marketing use, while security (68) credits the PIN-based UPI design and a clean breach record.